Search 5,985 TCP and UDP ports by number, service or category. Get the protocol, what runs there, RFC references and whether it is safe to expose.
This port reference searches a database of 5,985 registered TCP and UDP ports and tells you what each one is for, which protocol it uses, what category of service it belongs to, and what the security implications of exposing it are. Type a port number to identify it, or type a service name to find the port it runs on — the search works in both directions.
It is the lookup you reach for when a firewall log shows traffic on a port you do not recognise, when an application’s documentation says “open the required ports” without saying which, or when you are reviewing a rule set and need to know whether port 5900 belongs on the public internet. Every entry includes a plain-language security note, and where the port is defined by a standards document the relevant RFC is cited.
3389 and get Remote Desktop Protocol, TCP, plus the reason it should never face the internet directly.postgres, kerberos, or ldap to find the ports a service uses, including its secondary and alternate ports.Search an unassigned number and you still get an answer: the tool confirms the port is within the valid 0–65535 range and tells you it is unregistered, which is itself useful information when you are triaging unexpected traffic. Results are paginated, and the page size is adjustable for when you want to scan a whole category at once.
| Range | Name | Who assigns it | Typical use |
|---|---|---|---|
| 0–1023 | Well-known / system ports | IANA | Standard services: HTTP, SSH, DNS, SMTP |
| 1024–49151 | Registered / user ports | IANA on request | Vendor applications: databases, management agents |
| 49152–65535 | Dynamic / ephemeral ports | Nobody — allocated by the OS | The client side of outbound connections |
On Unix-like systems, binding to a port below 1024 traditionally requires root or an explicit capability such as CAP_NET_BIND_SERVICE. That is why web servers historically started as root and dropped privileges, and why containerised applications usually listen on 8080 internally and are published on 443 by the platform. The ephemeral range is also why a firewall rule that only permits inbound 443 still works for outbound traffic — the reply arrives on a high-numbered port belonging to an established connection, which stateful firewalls track separately.
| Port | Protocol | Service | Exposure guidance |
|---|---|---|---|
| 22 | TCP | SSH | Key-only auth, restrict by source address |
| 25 / 587 / 465 | TCP | SMTP / submission / SMTPS | 25 for server-to-server, 587 for clients |
| 53 | TCP + UDP | DNS | Never run an open recursive resolver |
| 80 / 443 | TCP | HTTP / HTTPS | Redirect 80 to 443; the only pair most hosts need public |
| 123 | UDP | NTP | Restrict monlist-style queries; classic amplification vector |
| 445 | TCP | SMB | Internal only, always — the EternalBlue and ransomware path |
| 1433 / 3306 / 5432 | TCP | SQL Server / MySQL / PostgreSQL | Bind to localhost or a private subnet, never 0.0.0.0 |
| 3389 | TCP | RDP | Behind a VPN or gateway; the most brute-forced port on the internet |
| 5900 | TCP | VNC | Unencrypted by default; tunnel over SSH |
| 6379 | TCP | Redis | Historically unauthenticated; bind to localhost |
A caveat that matters: a registration tells you what a port is supposed to carry, not what it is carrying. Malware routinely uses 443 to blend into normal traffic, and administrators routinely move SSH to 2222. Confirm with the running process — ss -tulpn on Linux, netstat -ano on Windows — before drawing conclusions.
TCP is connection-oriented: a three-way handshake, ordered delivery, retransmission of anything lost. UDP sends datagrams with none of that, which makes it faster and lighter but places reliability on the application. Services that need every byte in order — HTTP, SSH, SMTP, database protocols — use TCP. Services that value latency over completeness, or that fit in a single datagram, use UDP: DNS queries, NTP, SNMP, syslog, most real-time media.
Many services are registered for both, which is why the protocol column in this database has three values. DNS is the classic example: queries go over UDP/53, but zone transfers and responses too large for a datagram fall back to TCP/53. Block TCP/53 in the belief that DNS is “a UDP protocol” and DNSSEC-signed responses start failing intermittently. QUIC has since moved a great deal of web traffic onto UDP/443 as well, so a firewall that only permits TCP/443 will silently push clients back to TCP HTTP/2.
65,536 per protocol, numbered 0 through 65535, because the port field in the TCP and UDP headers is 16 bits. This reference covers the 5,985 that have a registered or well-documented service associated with them.
It is unregistered — typically an ephemeral port allocated by an operating system for an outbound connection, or a port an application picked for itself. The tool confirms the number is valid and tells you no assignment exists, which is the correct answer rather than an error.
As a default, 80 and 443 and nothing else. Everything else should sit behind a VPN, a bastion host, or a source-address restriction. Management protocols — SSH, RDP, VNC, SMB, WinRM — and every database port belong on a private network. Each entry here carries a security note reflecting that.
Yes, and it is common. Moving SSH off 22 reduces automated scanning noise, though it is obscurity rather than security — a targeted scan finds it in seconds. The real controls are authentication, source restriction, and rate limiting.
Because IANA registers a service name against a port number for both protocols even when only one is used in practice, and because some protocols genuinely use both — DNS on 53 being the standard example.
A closed port answers — TCP sends a RST — telling the scanner the host is up but nothing is listening. A filtered port produces no answer at all, because a firewall dropped the packet. Scanners report these differently, and the distinction tells you whether a firewall is in the path.
On Linux, ss -tulpn lists listening sockets with the owning process. On Windows, netstat -ano plus Task Manager maps a PID to a program. On macOS, lsof -iTCP -sTCP:LISTEN -n -P. Cross-reference the results here to confirm each listener is one you intended.
DNS records for the host — our DNS lookup tool resolves them — and the network boundaries themselves. The subnet calculator helps you define the source ranges a rule should permit, and the firewall rule simulator tests whether a rule set actually blocks what you think it does.
A port reference provides a comprehensive lookup of TCP and UDP port numbers, their assigned protocols, and their security implications. Ports are logical endpoints that operating systems use to direct network traffic to the correct application—like apartment numbers in a building. Understanding which services run on which ports is fundamental to network administration, firewall configuration, and security operations.
The Internet Assigned Numbers Authority (IANA) maintains the official port registry, dividing the 65,535 available ports per protocol into three ranges: Well-Known Ports (0-1023), Registered Ports (1024-49151), and Dynamic/Ephemeral Ports (49152-65535). Security professionals need to know these assignments to interpret network scans, write firewall rules, and identify potentially malicious traffic.
When a client connects to a server, it specifies both an IP address and a port number. The server listens on a specific port for incoming connections. The combination of IP address + port number + protocol (TCP or UDP) uniquely identifies a network service.
| Port | Protocol | Service | Security Notes |
|---|---|---|---|
| 22 | TCP | SSH | Secure remote access; target for brute-force attacks |
| 25 | TCP | SMTP | Email relay; often blocked to prevent spam |
| 53 | TCP/UDP | DNS | Name resolution; DNS tunneling risk |
| 80 | TCP | HTTP | Unencrypted web traffic |
| 443 | TCP | HTTPS | Encrypted web traffic (TLS) |
| 445 | TCP | SMB | File sharing; historically vulnerable (WannaCry) |
| 1433 | TCP | MSSQL | Database; should never be internet-exposed |
| 3306 | TCP | MySQL | Database; restrict to localhost or VPN |
| 3389 | TCP | RDP | Remote desktop; major attack target |
| 5432 | TCP | PostgreSQL | Database; restrict access carefully |
| 8080 | TCP | HTTP Alt | Common for proxies and dev servers |
| 8443 | TCP | HTTPS Alt | Common for management interfaces |
Port states in scanning:
netstat or ssNetwork ports are logical endpoints in TCP/IP networking, numbered 0-65535, that enable multiple services to operate on a single IP address. Ports direct traffic to specific applications: web servers use 80/443, email uses 25/587/993, SSH uses 22. Understanding ports is essential for firewall configuration, troubleshooting connectivity, and securing network services properly.
TCP (Transmission Control Protocol) provides reliable, connection-oriented communication with error checking and guaranteed delivery. UDP (User Datagram Protocol) offers connectionless, faster communication without delivery guarantees. TCP suits applications needing reliability (HTTP, SSH, email); UDP suits speed-critical services (DNS, streaming, gaming). Many services support both protocols on the same port.
Well-known ports (0-1023) are reserved for common services by IANA and require administrator privileges. Examples: 22 (SSH), 80 (HTTP), 443 (HTTPS). Registered ports (1024-49151) are assigned to specific applications by IANA but don't require privileges. Dynamic/private ports (49152-65535) are temporary ports for client connections. Always verify port assignments before deployment.
Block inbound connections on all ports except those explicitly required for services. High-risk ports include: 23 (Telnet), 135-139/445 (SMB/NetBIOS), 3389 (RDP), 5900 (VNC). Allow only: 80/443 for web, 22 for SSH (change default), required application ports. Implement egress filtering too, blocking unexpected outbound connections to prevent data exfiltration and command-and-control communication.
Attackers frequently target: 22 (SSH brute force), 23 (Telnet default credentials), 80/443 (web vulnerabilities), 3389 (RDP attacks), 445 (SMB exploits like WannaCry), 21 (FTP), 1433/3306 (databases). They also scan high ports for backdoors and use non-standard ports to evade detection. Monitor all open ports, not just common targets, with intrusion detection systems.
Windows: Run "netstat -ano" or "Get-NetTCPConnection" in PowerShell. Linux/Mac: Run "netstat -tuln", "ss -tuln", or "lsof -i". External scanning: Use nmap ("nmap -sT [IP]") or online port scanners. Always scan from both internal and external perspectives to understand exposure. Document all open ports and their purposes for security baseline and compliance.
Changing default ports provides minimal security through obscurity. It reduces automated scanning but determined attackers will discover services regardless. Better strategies: disable unnecessary services, use strong authentication, keep software updated, implement network segmentation, and monitor traffic. If changing ports, document changes carefully and ensure monitoring tools reflect new configurations to avoid blind spots.
Port forwarding redirects external traffic to internal network devices, enabling services like remote desktop, web servers, or game servers behind NAT. Configure on routers to map external ports to internal IP:port combinations. Use cautiously: each forwarded port increases attack surface. Prefer VPN access over port forwarding. If necessary, use non-standard ports, strong authentication, and monitor logs regularly.
Block unused ports and known-vulnerable services like Telnet (23), NetBIOS (135-139, 445), and RDP (3389) unless needed. Allow only essential services through specific ports. Implement default-deny policies where all traffic is blocked except explicitly allowed connections.
TCP (Transmission Control Protocol) is connection-oriented with guaranteed delivery, ordering, and error checking - ideal for web, email, and file transfers. UDP (User Datagram Protocol) is connectionless with no delivery guarantees but lower latency - used for streaming, gaming, and DNS.